How to remove dm-crypt plain-mode encryption?

ccapmet · 2018-10-26 16:24:16

Hi,

I wanted to know if there was any way to remove my plain-mode encryption (without losing my files) so that I can reencrypt it with a new keyfile since plain-mode doesn't allow changing keyfiles or passphrases.

sdb              8:16   0 238.5G  0 disk  
└─x            254:0    0 238.5G  0 crypt 
  ├─store-root 254:1    0    80G  0 lvm   /
  └─store-home 254:2    0 158.5G  0 lvm   /home

thats my lsblk.
If I lvremove, vgremove, pvremove, that would delete all of my files along with it?

I know I can just backup, reinstall arch and reencrypt but I'm just asking this to see if I can avoid the reinstallation.
There's a chance I am just overthinking it and the answers really obvious but I haven't found one yet.

Any help is appreciated, Thank you.

mpan · 2018-10-26 19:10:58

Isn’t cryptsetup-reencrypt what you are searching for? But be warned that if anything goes wrong, you lose your data.

ccapmet · 2018-10-26 19:27:34

mpan wrote:

Isn’t cryptsetup-reencrypt what you are searching for? But be warned that if anything goes wrong, you lose your data.

from the manpage it says "cryptsetup-reencrypt - tool for offline LUKS device re-encryption" but my drive isn't LUKS encrypted so I don't think this is the answer

mxfm · 2018-10-27 10:38:52

Back up the data and encrypt again.

mpan · 2018-10-31 08:00:26

ccapmet wrote:

from the manpage it says "cryptsetup-reencrypt - tool for offline LUKS device re-encryption" but my drive isn't LUKS encrypted so I don't think this is the answer

For some reason I thought that it works for both. Indeed it is for LUKS only. I searched a bit and it seems that indeed there is no way to perform that operation using cryptsetup.

While I can see a method to do it in-place (see below), I’m also supporting the opinion that the best option is to just copy to another medium, create proper LUKS container and copy back. That “another medium” can be a disk someone will borrow to you for a few days. Remember to create encrypted partition on it before copying, so your data woul not leak.

If the encrypted filesystem is not full, I see a method of doing re-encryption in place. It is, however, time consuming and IMHO not worth the effort. The idea is like this: shrink filesystem on the encrypted partition (resize2fs for ext2+ filesystems)), shrink the partition itself. This way you have some free space at the end of the encrypted block. Create a LUKS-encrypted partition there, create filesystem. Move as many files as will fit. Unmount both. Now you can again shrink the old filesystem, shrink the old partition, move the new partition back, grow it, grow filesystem in it and move more data. And so on, until you move all. Be very careful to chose sizes, tools and options properly, because in one of the steps you may end up performing a move on overlapping areas!!! But, as I said, I strongly advise to rather find someone who will give you a disk for some time. Safer, less time-consuming, simpler.

Last edited by mpan (2018-10-31 08:16:33)

Arch Linux

#1 2018-10-26 16:24:16

How to remove dm-crypt plain-mode encryption?

#2 2018-10-26 19:10:58

Re: How to remove dm-crypt plain-mode encryption?

#3 2018-10-26 19:27:34

Re: How to remove dm-crypt plain-mode encryption?

#4 2018-10-27 10:38:52

Re: How to remove dm-crypt plain-mode encryption?

#5 2018-10-31 08:00:26

Re: How to remove dm-crypt plain-mode encryption?

Board footer